CVE-2024-4263: 
NixOS vulnerability analysis and mitigation

A broken access control vulnerability exists in mlflow/mlflow versions before 2.10.1, where low privilege users with only EDIT permissions on an experiment can delete any artifacts. This vulnerability arises from insufficient validation of DELETE requests, allowing users with EDIT permissions to perform unauthorized deletions of artifacts despite documentation stating they should only have read and update capabilities (NVD, CVE).

The vulnerability stems from improper validation of DELETE requests in the artifact deletion functionality. Users with EDIT permissions can bypass access controls to delete directories inside artifacts, which contradicts the intended permission model. The vulnerability has been assigned a CVSS v3.1 base score of 5.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L, indicating network accessibility, low attack complexity, and required low privileges (NVD).

The vulnerability allows unauthorized deletion of artifacts within the MLflow platform. This can lead to data loss and disruption of machine learning experiments, as users with only EDIT permissions can delete artifacts they should not have permission to remove (NVD).

The vulnerability can be exploited by authenticated users with EDIT permissions on an experiment. The attack requires network access and low complexity to execute, making it relatively straightforward to exploit for users who already have basic access to the system (NVD, Huntr).

The vulnerability has been patched in MLflow version 2.10.1. Users are advised to upgrade to this version or later to address the issue. The fix includes proper validation of DELETE requests and enforcement of permission boundaries (Github Patch).